How do you handle mobile authentication in Laravel?

Laravel Sanctum is the default for most mobile apps in 2026, replacing Passport for new builds because it is simpler and lighter. Sanctum issues opaque tokens to mobile clients, supports token expiry and refresh, and integrates with Laravel's authorisation system. For OAuth 2.0 flows or third party API consumers we use Passport. For social login (Apple, Google, Facebook) we use Socialite. For SSO into corporate mobile apps we add SAML 2.0 or OIDC through dedicated packages.